The several common protocols for local area networks (LANs) include CSMA/CD (Carrier Sense Multiple Access with Collision Detection), token bus, and token ring. CSMA/CD is sometimes generically, but incorrectly, referred to as Ethernet, which is a product of the XEROX corporation using the protocol. I.E.E.E. has promulgated standards for these protocols, collectively known as IEEE 802, or also known as ISO 8802. IEEE 802.3 covers one-persistent CSMA/CD LAN; IEEE 802.4 and 802.5 cover token ring and token bus, respectively. These standards differ at the physical layer but are compatible at the data link layer in the seven layer OSI (Open Systems Interconnection) reference model.
CSMA/CD, token bus, and token ring are similar in the sense that they are all packet or frame based system in which inter-node communications are broadcast over a shared transmission medium. In CSMA/CD, a node wishing to transmit over the network cabling listens to ensure that the network is idle, i.e., no other node is currently transmitting. When the network is idle, the node may begin transmission. Due to the physical extent of the cable, however, the simultaneous transmission of two or more nodes may occur. This gives rise to what is termed a collision. To compensate for this eventuality, each node also listens while it transmits. In some cases, the average voltage during the transmission will be different if a collision is occurring on the network. In other cases, a jamming signal will be generated by a network hub unit. Each node should terminate their respective transmissions during a collision and generate a jamming signal for a predetermined period. The nodes then individually wait for a random time interval before seeking to retransmit.
Token bus and ring architectures mediate access to the network cabling by passing an abstraction known as a token between nodes. A node must wait until it receives the token before it may transmit. If the node receives the token but does not wish to transmit or once it has finished its transmission, it simply passes the token to the next node, by signaling that node. Under this system, collisions should never occur. Thus, there is no requirement that the nodes listen during their transmissions as required by CSMA/CD.
Different protocols can be used in networks that have larger physical extent such as metropolitan area networks (MANs) and wide area networks (WANs). MAN protocols tend to be similar to the LAN protocols. WANs typically have comparatively low data rates. Also, lower reliability increases the need for more error checking. WAN protocols are selected to compensate for these differences.
Other technologies are also emerging. Asynchronous transfer mode, more commonly known as ATM, is specially designed for inter-network communications. It relies on fixed sized packets which makes the protocol suboptimal for most, but compatible with virtually all, applications, but this compromise increases the speed at which the packets can be routed. Optical fiber based systems are becoming more common such as the fiber distributed data interface (FDDI).
In each protocol, the nodes must comply with the relevant rules that dictate the timing of transmissions to fairly allocate access to the network""s transmission bandwidth. Proper operation also dictates the format for the transmitted data. Packets must usually include a preamble to synchronize data decoding, comply with an error detection/correction scheme, and meet requirements for maximum and minimum lengths. There are a few techniques or devices that enable a network administrator to detect the violation of these rules, enabling diagnosis and location of the problems in the networks.
Protocol analyzers and remote monitoring (RMon) probes are commercially available devices that decode properly formatted digital transmissions on LANs, or similar networks. The devices function as passive network nodes that acquire packets and detect the cable voltages that are indicative of collisions. The origin, destination, and number of packets can be determined by reference to the packet""s headers and bandwidth utilization statistics accumulated for analysis. The number and frequency of collisions can also be monitored.
FIG. 1 illustrates the architecture for the network interface portion 1410 of a protocol analyzer or RMon probe, which incidently is similar to any other network interface chip for a node in a CSMA/CD-type network. The interface comprises a phase-locked loop 1420 that uses each packet""s preamble to synchronize to the source node. A decoder 1430 then extracts the destination address DA, source address SA, and data from the packet and performs error checking in response to a cyclic redundancy check CRC data contained in the frame check sequence (FCS) to ensure the packet 1440 is valid. On the assumption that it is, the decoder 1430 sends out only the destination address DA, source address SA, and data on the output line 1450. Simultaneously, a d.c. voltage threshold detector 1460 monitors the average voltage on the input line. In the example of 10Base(2) and (5), it will indicate a collision if the magnitude of the input voltage is more negative than xe2x88x921.6 Volts. This occurs because the simultaneous transmission from two or more sources are additive on the network cable. When a collision is detected, the threshold detector generates the signal on a collision sense line 1470 and also disables the decoder 1430.
Two packets 1440 and a noise signal 1480 represent successive inputs to the network interface 1410. The analyzer can only interpret properly formatted packets, however. Noise 1480 is not detectable by the device. Moreover, if the noise exceeds the xe2x88x921.6 Volt threshold of the detector 1460, the network interface 1410 may actually indicated the presence of a collision, but the source will not have been from typical network traffic.
In many cases, the protocol analyzers or RMon probes will not properly capture even valid packets on the network. If the gap between packets is less than 9.6 microseconds known as the inter-frame gap (IFG), the chip will usually miss the second in-time packet. Further, transmissions experiencing excessive attenuation or originating from a bad transmitter can result in collisions that are below the collision threshold. As a result, the analyzer will still attempt to decode the transmissions since the decoder will not be disabled. These devices can also saturate when a series of packet transmissions occur in quick succession.
Some of the shortcomings in the protocol analyzer and RMon probes are compensated by techniques that enable the analog analysis of the network transmission media. The most common one is called time domain reflectometry (TDR). According to this technique, a pulse of a known shape is injected into the cabling of the network. As the pulse propagates down the cable and hits electrical xe2x80x9cobstacles,xe2x80x9d or changes in the cable""s characteristic impedance, an echo is generated that travels back to the point of injection. The existence of the echo can indicate cable breaks, frayed cables, bad taps, loose connections or poorly matched terminations. The time interval between the initial transmission of the pulse and the receipt of the echo is a function of a distance to the source of the echo. In fact, by carefully timing this interval, the source of the echo can be located with surprising accuracy.
TDR analysis is typically used by installers to ensure that the newly laid wiring does not have any gross faults. The TDR signal is injected into the wiring while the network is non-operational to validate the transmission media. If a network is already installed, the network is first turned off so that TDR analysis can be performed. In a star topology network, the manager will typically check each link between the hub and host, marking any suspect wires. In bus topologies, the TDR signal is generated on the main trunk. In either case, reflections indicate breaks or defects in the network cables.
The shortcomings in the protocol analyzers and RMon probes surround the fact that they operate on the assumption that the physical layer, hardware and media, are operational. They attempt to decode the voltages transitions on the network cabling as data and sense collisions based upon the voltages relative to some preset thresholds, as in any other network card.
The operation of the analyzers impacts the available information, and thus limits their ability to accurately diagnose many of the problems that may afflict the network. Network cards, usually in nodes such as workstations or personal computers, may have been improperly manufactured, begin to degrade or become damaged. For example, one of the nodes on a network could have a defective driver in its output stage that transiently prevents it from driving the network cabling with sufficient power. The protocol analyzer or RMon probe would attempt to decode the packets from this node. If its phase-locked loop, however, can not lock on to the transmission, the analyzer will not recognize the attempt at transmission. If the analyzer can lock but the packet is invalid, the analyzer may label the packet as containing an error checking problem but will otherwise simply discard the packet without further analysis. Thus, the analyzer would provide no direct indication of the problems.
A packet can be undecodable for a number of other reasons such as improper formatting at the transmitter, failure to detect a collision or a defect in the cabling, to list a few possibilities. Interference is another problem. Elevators and fluorescent lights are common sources of network noise. This can corrupt otherwise valid packets or cause network devices to interpret the noise as communications or collisions. Moreover, 60 Hertz power frequencies can leak on the cabling, which can also confuse the decision structures in the network cards. Crosstalk with other communications networks can also occur. These problems are invisible to the analyzers.
Depending upon the particularities of the problems, the effect on the network can be nonexistent to catastrophic. The cards may simply generate bad packets or noise, bandwidth in some situations since the source node will attempt to retransmit until an performance impact can be high. A 1% loss of packets can lead to an 80% loss in bandwidth in some situations since the source node will attempt to retransmit until an xe2x80x9cacknowledgexe2x80x9d is received. Network cards have also been know to xe2x80x9cjabber,xe2x80x9d or continuously transmit. This will cripple the network by blocking other nodes from transmitting.
TDR techniques can provide some information concerning cabling problems. However, TDR typically can only be used when the network is not operating. An isolated TDR pulse on the network can cause the nodes to behave unpredictably. This limits its usefulness to testing cabling after initial installation but before operation.
In light of these problems, the present invention is directed to a network diagnostic device that samples the voltages on the cabling of the network by analog-to-digital digital (A/D) conversion, but preferably does so at a higher rate and with greater resolution then is required to minimally detect digital transitions on the cabling. This A/D sampling provides information on the analog characteristics of digital and noise signals on the network. As a result, the reasons why a particular packet may be illegal, either because of a subthreshold voltage transition or transient noise, for example, can be determined. Also, the nature of any network noise, crosstalk or interference can be identified and distinguished from legal and illegal transmissions. Further, node transmitters that cause improperly timed transmissions or fail to correctly detect or respond to collisions can be located. Defective cabling can also be identified. In short, the present invention provides the network manager or technician with a greater spectrum of information than would be available through typical digital decoding or TDR techniques. Even proactive maintenance is possible, allowing the network manager to predict rather than react to a failure mode.
In general, according to one aspect, the invention features a network analysis device for a digital data network. The device comprises a digitizer which digitally samples analog characteristics of signal events on the network and a system processor which downloads data of the sampled signal events from the digitizer, and which analyzes the signal events.
In specific embodiments, the system processor classifies the signal events as network communications or noise based upon parametric analysis of each event. The processor calculates certain parameters related to the voltage and frequency characteristics of the event and compares the parameters to ranges that are characteristic of different event classifications. The analysis can also include determining whether network communications are within frequency and voltage specifications for the network. The communications can also be Manchester and packet decodes by the system processor based upon the data.
In other specific embodiments, the network analysis device comprises an attachment unit for connecting the digitizer to the network. Typically, the unit comprises receivers which detect signals on the network and drivers which generate signals on the network. When the network has star topology, the unit comprises plural receivers which detect signals transmitted over separate links of the network and a summing circuit which combines the signals from each of the links on a channel of the digitizer. This summing, however, usually requires that asynchronous events, such as link pulses, on the links be eliminated. Thus, the unit also preferably comprises a link pulse elimination circuit which eliminates link pulses from the combined signal received by the digitizer.
The attachment unit may have other features. A selector circuit can be provided which individually enables the receivers to provide the detected signals to the summing circuit. Tagging circuits are also useful to generate a signal that identifies the link from which a sampled signal event originated for the system processor. The tagging signal can be combined with the signal events prior to sampling by the digitizer or stored in a buffer and correlated to the sampled signal events by the system processor.
In general, according to another aspect, the invention can also be characterized in the context of a method for monitoring the operation of a network. This method comprises digitally sampling analog characteristics of signal events on the network with a digitizer. The data arrays of the signal events are then downloaded to a system processor, which analyzes the data arrays to identify the signal events. The processor is then able to determine physical level characteristics of the network based upon the analysis.
In specific embodiments, the processor implements an event finder by comparing successive samples from the data arrays to thresholds and declaring the beginnings of events if the thresholds are satisfied. The ends of events are declared when the thresholds are no longer satisfied. Once found, parameters are calculated for the signal stop times for the signal events. Once found, parameters are calculated for the signal events from the data arrays including frequency and voltage characteristics, and the event are classified as transmissions from other network devices or interference by comparing the parameters to parameter ranges for event classifications. Collision are also determined along with start and stop times for colliders. This analysis allows the processor to locate network devices that improperly react to collisions with other network devices or are otherwise improperly operating.
The analog characteristics include parameter such as: Midpoint: min, max, mean, quantity; Preamble Frequency: min, max, mean, sdev; Event High Frequency: min, max, mean, sdev; Event Low Frequency: min, max, mean, sdev; Maximum Voltage Distribution: min, max, mean, sdev; Minimum Voltage Distribution: min, max, mean, sdev; Peak to Peak Distribution: min, max, mean, sdev; Rise Time Mean: min, max, mean, sdev; Fall Time Mean: min, max, mean, sdev; Overshoot: min, max, mean, sdev; Undershoot: min, max, mean, sdev; First Bit peak-to-peak Voltage; First Bit Min Voltage; First Bit Max Voltage; First Bit Width Voltage; First Bit Rise Time; First Bit Fall Time; Jitter: min, max, mean, sdev.
In another aspect, the invention also concerns a method for identifying sources of transmissions on a network. This is referred to signature matching. The process involves calculating a plurality of analog parameters for transmissions from known sources. The parameters are also calculated for a transmission from an unknown source. The unknown source can then be identified based upon the degree to which the parameters match parameters from the known sources.
The above and other features of the invention including various novel details of construction and combinations of parts, and other advantages, will now be more particularly described with reference to the accompanying drawings and pointed out in the claims. It will be understood that the particular method and device embodying the invention is shown by way of illustration and not as a limitation of the invention. The principles and features of this invention may be employed in various and numerous embodiments without departing from the scope of the invention.